Privacy Policy

We collect different information depending on how you use Soma.

Website and waitlist

If you join our waitlist, we collect the email address you give us, together with technical details of that sign-up: your IP address and the approximate location it suggests (country, region, city), your browser, device, screen size, language and time zone, the page you arrived on, the website or campaign link that sent you, and the pages you viewed on our site during that visit. We use them to keep automated and abusive sign-ups out and to learn which channels bring people to Soma. The details of your visit are kept in your browser’s session storage, not in a cookie, and are cleared when you close the tab. The sign-up form is protected by Vercel’s bot detection, which checks your browser for signs of automation.

Our website does not set advertising or analytics cookies and does not load third-party trackers, and our fonts are hosted by us rather than a third party. Like most websites, our hosting provider keeps standard server logs, such as IP address, browser type, pages requested, and time, to deliver and secure the site. We keep these logs for a short period, typically no more than 30 days.

We count visits with Vercel Web Analytics, a service of our hosting provider. For each page you view, it records the page, the website or campaign link that sent you, your approximate location (country, region, city), and your browser, operating system, and device type. It sets no cookie: it tells visits apart with a value computed from your request, which it discards after 24 hours, and it cannot follow you across other websites. We only see totals, never an individual visitor.

The app on your phone

With your permission, the Soma app reads data from Apple Health. Access is read-only: Soma never writes anything back to Apple Health, and it only reads the data types you specifically allow. Sensitive types, for example reproductive health and basal body temperature, are requested separately from other types, and only when a feature actually needs them. The Today screen is computed on your device and works offline. Today, the app has no account, and nothing you read in it leaves your phone.

History sync and your account

You can choose to turn on history sync. When you do, a compressed copy of your raw Apple Health record is uploaded once (queued until you are back online, if needed) and stored as your raw record on servers we rent from Microsoft Azure in the United States. Our server-side engines turn that record into a small number of derived facts, for example a biological age estimate and long-term trends, and return each one with its date, how much data it is based on, and the version of the engine that computed it. Using history sync needs an account: your email address, an optional name, a way to sign in (which may include Sign in with Apple), and any profile details you choose to add, such as birth date, sex, height, and weight. If you write notes or log your mood in the app, those are stored with your record once history sync is on.

Services you connect

If you connect another service to Soma, for example a wearable maker’s account, we receive the data you authorize from that service, either directly or through an integration provider.

AI features

If you use a feature that answers a question in plain language, we send your question, and only the part of your data that feature needs, to an AI model provider. This happens through a routing service, OpenRouter, rather than a direct connection to a single provider.

When you contact us

If you email us, we keep that correspondence, and anything you choose to include in it, to respond to you and to keep a record of the request.

Access to Apple Health is read-only and limited to the data types you allow; Soma never writes to Apple Health. Sensitive categories, such as reproductive health and basal body temperature, are requested separately from other types, and only when a feature needs them. We do not store your Apple Health data in iCloud. We do not use it for advertising or marketing, and we do not give it to data brokers.

You can turn off Soma’s access to Apple Health at any time, in the iOS Settings app, under Health, then Data Access & Devices, then Soma.

We use what we collect to run Soma and to keep improving it:

• To show you the Today screen and other on-device features.
• If you turn on history sync, to store your raw record, and to compute and show you derived facts such as a biological age estimate and long-term trends.
• If you use an AI feature, to answer your question.
• To operate, maintain, and secure our website and the app, including through server logs, and to count visits to our website.
• To send you waitlist and account-related messages, such as an invitation or a notice about this policy.
• To keep automated and abusive sign-ups off the waitlist, and to learn which pages, websites, and campaigns bring people to Soma.
• In de-identified or aggregated form, meaning it cannot reasonably be used to identify you, to improve Soma. See Research and De-identified Data below.

We do not use what we collect to advertise to you, and we do not sell it. See How We Share Information below.

Today, before you turn anything on, Soma has no account and works entirely on your phone. The Today screen is computed on your device using the Apple Health data you allow, and it works offline. Nothing you see on that screen is sent to us.

This changes only when you choose it. Turning on history sync is what starts sending a copy of your record, and the notes you write, to our servers, as described in What We Collect above. You can turn history sync back off at any time; see Your Choices and Rights below.

Service providers

We share information with the following service providers, each bound by contract to use it only to provide their service to us:

• Cloud hosting and storage: Microsoft Azure, in the United States, for your account, your raw record, and your derived facts.
• Website hosting, delivery, bot protection, and visit counts: Vercel, to run somalabs.me and its sign-up form, and to count visits to it.
• Website database: Supabase, for the blog and the waitlist.
• Email delivery, for waitlist and account emails.
• AI model providers, through OpenRouter, only if you use an AI feature.
• Integration providers, only if you connect another service.

We only use AI model providers that act on our behalf: they may not use what you send to train their models, and may not keep it any longer than they need to answer your question.

Outside of service providers, we disclose information only when the law requires it, to protect rights and safety, in connection with a merger or acquisition (in which case your data stays protected under this policy, and we will tell you), or with your consent.

What we never do

• We do not sell your personal information.
• We do not share it for cross-context behavioral advertising.
• We do not use your Apple Health data for advertising or marketing.
• We do not give health data to data brokers.
• We do not store your Apple Health data in iCloud.
• There are no ads in Soma.

Separate from the app, Soma Labs Inc. runs research studies, for example measuring pulse from a camera next to a reference chest strap. These studies are for adults only, and each one has its own written consent form.

Using the Soma app does not enroll you in a research study. We do not use data collected through the app in a study unless you separately give opt-in consent to that specific study.

Apart from named studies, we may use de-identified or aggregated data, meaning data that cannot reasonably be used to identify you, to improve Soma. We commit not to attempt to re-identify it.

Two features you may have seen described are not available yet: camera-based pulse measurement inside the app, and the Soma Axon device. Neither one collects anything from you today.

Before either starts collecting anything, we will give you a separate notice and ask for your explicit consent. That notice will explain, among other things, how long we keep face video and any data derived from it.

How long we keep information depends on what it is:

• Your waitlist email address: until we invite you or you ask us to remove it, and in any case no longer than 24 months after you joined.
• The technical details of a waitlist sign-up: as long as your waitlist email address, except the IP address and the precise location (postal code and coordinates), which we remove after 12 months.
• Sign-up attempts we turn away, for example automated or invalid ones: 90 days.
• Your account, your raw record, and your derived facts: while your account stays open.
• After you ask us to delete your data: we remove it from our live systems within 30 days, and it rolls off our backups within 90 days.
• Server logs: typically 30 days or less.
• Visit counts: the value that tells visits apart is discarded after 24 hours; what remains does not identify you.

We use safeguards designed for health data: encryption in transit between the app and our servers, access limited to the few people who need it to run Soma, and ongoing review of our practices. No system is perfectly secure, and we cannot guarantee absolute security.

If a breach affects your data, we will notify you and the relevant authorities as the law requires.

You can limit what Soma collects, and you can ask us to act on the data we hold.

Controls

• Turn off Soma’s access to Apple Health at any time, in iOS Settings, under Health, then Data Access & Devices, then Soma.
• Turn off history sync at any time.
• Delete the app.
• Unsubscribe from waitlist emails using the link in any message we send.

Requests

You can ask us for access to your data, a copy of it, a correction, or deletion, by emailing privacy@somalabs.me.

We respond within 45 days. If we need more time, we will tell you, and may take one further 45-day extension. We verify requests, for example by confirming the email address on your account, and we will accept a request made by an authorized agent on your behalf if they can show us proof of that authority. If we refuse a request, you can appeal by replying to our response; we will answer your appeal within 45 days and tell you how to contact your state attorney general if you are not satisfied.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights described below.

We do not sell or share your personal information, as those terms are defined under California law, and we have not done so in the past 12 months. Because there is nothing to opt out of, a Global Privacy Control signal from your browser changes nothing, but we still treat it as a valid request. We use sensitive personal information, meaning your health data and your account sign-in, only to provide the services you ask for (for example, computing your derived facts) and to keep your account secure, and for no other purpose.

Your rights

• Know what personal information we have collected about you, and how we have used and shared it.
• Delete your personal information, subject to certain exceptions.
• Correct inaccurate personal information.
• Receive a portable copy of your personal information.
• Not be discriminated against for exercising these rights.

To exercise any of these rights, see Your Choices and Rights above.

Washington’s My Health My Data Act, Nevada law, and similar laws in other states give added protection to consumer health data. For residents of Washington, this section is Soma’s Consumer Health Data Privacy Policy.

Categories, sources, and purposes

We collect consumer health data, including the Apple Health data you allow, the notes and mood you choose to write down, and the derived facts we compute from your raw record, such as a biological age estimate and long-term trends. This comes from Apple Health with your permission, from what you enter into the app, and from our own computation. We use it to provide the Today screen, history sync, and any AI feature you choose to use.

How We Share Information

We share consumer health data only with the service providers described in How we share it above, who process it on our behalf. Your raw Apple Health record, your notes and mood, and your derived facts are stored with our cloud host. If you use an AI feature, your question and the part of your data needed to answer it go to an AI model provider through OpenRouter. We have no affiliates that receive consumer health data. We do not sell consumer health data, and we do not use geofencing.

How consent works

Granting Soma access to Apple Health and turning on history sync are separate, revocable choices. Granting one does not grant the other, and you can withdraw either at any time using the controls described in Your Choices and Rights above.

Your rights

• Confirm whether we process your consumer health data.
• Access it.
• Receive a list of the third parties and affiliates we have shared it with.
• Delete it.
• Withdraw your consent.

To exercise any of these rights, email privacy@somalabs.me.

Soma is for adults 18 and over, in the United States, and is not directed to children. If we learn that we have collected personal information from someone under 18, we will delete it.

We store and process your data in the United States, including on cloud infrastructure we rent from Microsoft Azure.

We may update this policy from time to time; the date at the top always reflects the latest version. If a change is material, we will tell you, in the app or by email, before it takes effect. We will not use health data we already collected in a materially different way without your consent.

If you have a question about this policy, or want to exercise any of the rights described above, email privacy@somalabs.me. For the terms that govern your use of Soma, see our Terms of Use.